DTSPO-34108: clarify Front Door TLS certificate guidance

[manohar-hmcts]

Jira link

See DTSPO-34108

Change description

• Front Door page: replaced the "TLS certificate has been stored in vault" step with how certificates work now (fixes Re: 'Front Door configuration' #195)
• Default is an Azure-managed certificate, validated by a DNS record the pipeline adds; a Key Vault certificate is only used when an entry sets ssl_mode = "AzureKeyVault" (per terraform-module-frontdoor frontdoor.tf / data.tf; default ssl_mode is FrontDoor in CFT and SDS)
• Notes that certificate_name without ssl_mode has no effect, and the hosted_externally case

Testing done

• Checked against the module and CFT/SDS prod tfvars: 9 of 72 CFT and 2 of 33 SDS prod entries use Key Vault
• CI build, spelling and link checks on this PR

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• Does this PR introduce a breaking change